CVE-2026-9082: Drupal Core SQL Injection Vulnerability in PostgreSQL Databases
Summary
CVE-2026-9082: Drupal core includes a database abstraction API to ensure that queries executed against the database are sanitized to prevent SQL injection attacks. Affects drupal/core across 6 version ranges.
>= 8.9.0, < 10.4.10
>= 10.5.0, < 10.5.10
>= 10.6.0, < 10.6.9
>= 11.0.0, < 11.1.10
>= 11.2.0, < 11.2.12
>= 11.3.0, < 11.3.10
Fixed in 6 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- drupal · Bitnami
The same CVE-2026-9082 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a widely-used open-source content management system (CMS) that enables users to create and manage websites easily. It features a robust database abstraction API that sanitizes database queries to prevent SQL injection attacks. However, a recent vulnerability has been identified that specifically affects sites using PostgreSQL databases, potentially compromising their security.
Vulnerability Detail
A vulnerability in Drupal's database abstraction API allows attackers to send specially crafted requests, leading to arbitrary SQL injection on sites using PostgreSQL. This can result in information disclosure, privilege escalation, remote code execution, or other attacks. The vulnerability can be exploited by anonymous users, making it critical for site administrators to address it promptly.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.9.0, < 10.4.1010.4.10composer require drupal/core:10.4.10 -
>= 10.5.0, < 10.5.1010.5.10composer require drupal/core:10.5.10 -
>= 10.6.0, < 10.6.910.6.9composer require drupal/core:10.6.9 -
>= 11.0.0, < 11.1.1011.1.10composer require drupal/core:11.1.10 -
>= 11.2.0, < 11.2.1211.2.12composer require drupal/core:11.2.12 -
>= 11.3.0, < 11.3.1011.3.10composer require drupal/core:11.3.10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched versions as soon as possible.
Conclusion
The CVE-2026-9082 vulnerability in Drupal Core poses a significant risk to sites using PostgreSQL databases. Immediate action is required to update to the patched versions to mitigate potential attacks. Regular monitoring and updates are essential for maintaining the security of your Drupal installations.
See every vulnerability recorded for drupal/core →
FAQ
CVE-2026-9082 is a security vulnerability in Drupal Core that allows SQL injection attacks on sites using PostgreSQL databases.
The vulnerability can be exploited by anonymous users, making it crucial for site administrators to take immediate action.
Exploitation can lead to information disclosure, privilege escalation, remote code execution, and other attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, it is highly recommended to prioritize updating your Drupal core to the patched versions as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
